As an entirely unrelated mention, I’ve put the soerensays2 theme into a Mercurial (Hg) repository, so I can start making some changes to it. I’m just gonna let the log messages so far speak for themselves:

changeset:   4:8d2ac374a722
tag:         tip
user:        Sören Kuklau 
date:        Sat Dec 12 16:50:25 2009 +0100
summary:     pre/code: add Menlo; no need to make it larger any more; no indentation

changeset:   3:dd105c8d8777
tag:         tip
user:        Sören Kuklau 
date:        Sat Dec 12 16:02:48 2009 +0100
summary:     No more columns; 32em instead of 25em; 18px instead of default (e.g. 16px); centered for now

changeset:   2:c1d03afcbb24
user:        Sören Kuklau 
date:        Sat Dec 12 15:43:06 2009 +0100
summary:     Remove the header link for now; was never properly implemented

changeset:   1:741937fb2884
user:        Sören Kuklau 
date:        Sat Dec 12 15:31:50 2009 +0100
summary:     Restore double-em style

changeset:   0:10dd0d874700
user:        Sören Kuklau 
date:        Sat Dec 12 15:28:41 2009 +0100
summary:     Initial

Kudos to Peter Hosey for Lazytwitter-style help with uploading a de-repository’d copy of the WP theme to the Web server via SSH. Looks something like this:

hg archive -t tar -p 'yourtheme' - | ssh example.com 'tar xf - -C ~/path/to/wp-content/themes'

As I’ve noticed with lil’ side projects such as Denis’s all-new Ruby-based CyanChat relay, working with a distributed versioning system feels ridiculously liberating to a developer. I can see what all the fuss is about. I just still question it would work well in all kinds of environments where Subversion does.

In your mind, this should be a post about a perfect vacation, for that is what it was.

It was long enough that it left me with plenty of impressions; short enough that it left me longing for more; different enough that there’s no stereotyping it. It had all the inevitable periods drama and of silence; of idiosyncrasies and of joy; of impression and of reflection. As much as I would have loved for it to be longer, such change would have destroyed its nature.

While I only met Marein very briefly, I very much enjoyed his company (and thanks for the hat! →). It’s a rare moment for me to meet other Myst fans / like-minded thinkers, so I shall treasure it.

---

I’m getting ahead of myself, however.

You see, going on this vacation hadn’t been an easy decision to make. It seems I have a very, very limited range of activities that I enjoy, and only under specific circumstances. I’m still in the very early stages of exploring that, but I do know I’ve had my share of experiences that, by society’s standards, I ought to have taken delight in but did not. I don’t blame anyone for that simple fact, nor for trying hard to force me to “have fun” (even when I don’t show it, I do appreciate the attempt), though I do hope for more understanding in the future that I’m mostly not ‘like that’.

I don’t want to say past vacations have left me scarred, but they ended up making me afraid to take some time off from work, and they made me wary and hesitant when vaaht offered — to the point where I hoped I had school that week so I’d have a proper excuse not to come. No such ‘luck’.

I have those sudden rushes of self-coercion, however, and one of them made me buy the train ticket there (the fact that it was surprisingly cheap helped!); then followed a week of two of random worries and mental explorations (my ID had expired; would I manage to kick my bottom and get a temporary one in time? would I manage to buy the ticket back? would I actually go, or decide last-minute that, despite the effort and payments, I’d just chicken out and stay right here?); then, an odd untimely breakdown the weekend before; finally, the decision to stop thinking and do this.

And I just love the stop thinking and do this moments, for they play a large role in pushing me forward.

---

I find it fascinating, disturbing and disturbingly fascinating (or fascinatingly disturbing? Uh, never mind.) how the current state of mind can feel perfectly rational one moment and, as it changes, absurdly irrational the next. I can go from it making perfect sense not to “risk” going on a vacation for hours to it feeling incredibly foolish, childish and, as kids these days say, lame, man.

---

So I took the train to Bremen, and I took the train to Osnabrück (which, despite being an ICE, and me sitting at a table, had me fail to find any power outlet), and the IC to Hilversum (much older technology, much less fancy, but… power outlet!). And, eventually, the weird-looking Dutch IC to Amsterdam.

Somewhere on the way to Hilversum, there was an odd announcement I failed to properly listen to, despite being in Dutch, English and German (as far as I recall). I immediately began to regret not listening, because some confusion and worrying followed. It turned out they must have merely said that we’re crossing the border, which explains electricity briefly going out, change of staff (I think?), et cetera.

That, I suppose, was the most worrying part of the trip. Until, that is, I arrived in Amsterdam. I seem to have a propensity to end up in Amsterdam

• looking to meet someone,
• failing to find them within the don’t-worry-about-it span of time.

Add to that my dumb decision the night before not to properly say good bye to mentioned involved parties and go absolutely sure we had agreed on where to meet, and there I was at a train station that, in my stress, seemed much more humongous and confusing than it did on my way back Thursday evening. An eery reminder of me in Schiphol, the summer of 2003, trying to meet someone I had never seen before and of whom I wasn’t entirely sure what he looked like.

Following the futile attempt to walk down what seemed like an entire mile length’s worth of platform 13/14 (13? You can’t make this up!) — I had arrived at 14b; Marein, I believe, was supposed to have arrived at 13a, I descended the stairs only to be overwhelmed, but eventually succeed to find the Starbucks. But not vaaht.

It didn’t help that Amsterdam Centraal has odd gates with little stop signs that make it look as though you need tickets to go through, but as Marein explained, this is apparently a system that they haven’t fully finished developing. Welcome to the world of software development?

After several attempts to partially walk in the Starbucks, not see her, walk back out, and keep walking back and forth, I sighed, resigned, and stood up with my back against a pole. That’s when Marein showed up in front of me. His train got canceled, so he was late. Having spent some time searching for vaaht together, we eventually found each other. Her flight had gotten delayed by an hour.

On Thursday night, though, my dad would tell me a story of how he ended up in a small French town waiting to find friends of his for something like 7 hours, so I suppose I should consider myself lucky — as terribly as the panicking I had felt, it must have taken 15 minutes, if even that, to be resolved.

---

What followed was the true part of the vacation.

Monday night: going to Subway with the two of them, then to the hotel, unpacking and chatting for a while, Marein eventually having to catch his train back home, and so on. His journey was almost twice as long as the time he got to hang out with us, but it was a rare moment of quality time.

Tuesday: lots of walking; mostly along the street market. Also, food.

Wednesday: Van Gogh museum, and more and better food.

Thursday until the afternoon: Anne Frank house, but perhaps not enough food.

All of those days? Talking. Lots and lots of talking. It’s a rare, relish-worthy moment when two people who have so much to say to each other meet. This is literally invaluable; you cannot put the worth of this into materialistic measurements.

---

Starting Wednesday night, I felt regret for it having been so brief. And yet, at the same time, I think the shortness forced us to make the most of it. The deadline didn’t feel liberating, but not stressful either.

I had said to someone that I cannot decide whether I should be elated that I’ve met someone who understands me, or concerned that this never seems to happen to me in Germany. That’s a bit of hyperbole, though: as much as I wish I’d have such fine moments in life more often, I’m truly happy this one did occur.

In other words: it’s been a great opportunity, and I used it. That counts for something.

Now, on to the quest of finding more.

On Friday, Mozilla blacklisted two Microsoft add-ons for Firefox: the .NET Framework Assistant extension, and the Windows Presentation Foundation plug-in. The latter of the two contains a security issue that has since been fixed as part of MS09-054. As far as I can tell, there was no such issue with the former.

What are these add-ons?

The two add-ons are related in that they both ship as part of .NET Framework 3.5 SP1¹, but unrelated in their purpose.

• The .NET Framework Assistant allows ClickOnce applications to be installed (into a sandbox) and launched from Firefox. ClickOnce is comparable to Java Web Start, except that it works for applications written for .NET, not Java. Without the “assistant”, you can still download the .application manifest file (an XML-based file format including a digital signature and a URL pointing to the actual application binaries and resources) and launch it afterwards, but if the name wasn’t a giveaway, seamlessness is the very point of ClickOnce.
• Windows Presentation Foundation (WPF) is the new GUI toolkit for .NET, replacing Windows Forms. A subset of WPF wrapped inside a sandbox was originally known as WPF/e (for “everywhere”) and later on branded as Silverlight. This plug-in, however, is for the full WPF, except also for applications running in a sandbox. It’s as confusing as it sounds.

The latter is where the vulnerability occurred; due to the existence of the plug-in, it affected Firefox.

Why do I have those add-ons? Why can’t I uninstall them?

In a controversial move, they were bundled with .NET Framework 3.5 SP1. There is no way of customizing the install² such that you skip those add-ons.

As for uninstallation, the story is once again different for the two:

• The original version of the .NET Framework Assistant can’t be uninstalled from within Firefox due to its method of installation. Reasonably, it is installed system-wide (just like .NET itself is system-wide). Unfortunately, while Mozilla provides a developer-level guide for doing so (using the Windows Registry), it doesn’t provide a user-level one for undoing so. Presumably, Firefox would have to provide an external application that is launched with administrator privileges (and therefore, an user rights elevation dialog to launch it) in order to change or remove the installation. The button isn’t missing for some conspiratory reason on Microsoft’s part, but because of what is arguably a missing capability in Firefox. Uninstallation could be done by manually removing the Registry entry.

  In a later update, Microsoft changed the extension to be installed per-user. This allows uninstalling (although only for yourself!) from within Firefox.

• As Windows Presentation Foundation is a plug-in, it cannot be uninstalled from Firefox at all. Again, this is something Firefox doesn’t support, not something Microsoft went ouf ot their way to prevent.

So, what now?

The vulnerability has been fixed, but only two days before Mozilla decided to blacklist the extension. Problematically, many users are known to wait days, months or sometimes millennia³ to install patches, whether out of a (sometimes rational) fear that they will break other things, because they don’t have permission or knowledge to do so, or for other reasons.

Unfortunately, even if you do have the patch installed, the add-ons are still blacklisted. As I understand it, the add-ons’ versions⁴ haven’t changed from the patch, so Mozilla is unable to verify that you do in fact have them patched. While it is possible to query Windows Update for what patches are installed, such code would presumably require an update to Firefox itself.

Two things trouble me more: from what I can see, the first add-on did in fact not have a vulnerability at all, so ClickOnce support is currently broken in Firefox for what appears to be no actual reason. Second, Mike Shaver claims that “Microsoft is recommending that all users disable the add-on.”, but my reading of their blog entry suggests that, as long as you have the patch installed, you don’t need to disable the add-on at all.

1. Which should have been named 3.6, as it adds some completely new features, such as the ADO.NET Entity Framework. ↩
2. To my knowledge, that is. ↩
3. Hyperbole included. ↩
4. Or the UUID? ↩

I learnt something this week. Well, that’s not quite true — I had been suspecting this for a while, but as of this Wednesday, I’ve finally gathered enough evidence.

I’ve been fortunate enough to get to know a broad range of viewpoints through school and my surroundings. That becomes self-perpetuating after a while: once you realize that, in many situations of life, what you assume to be true — because your parents / teacher / friends all have been saying it is — may be far less black and white than that, you learn to leave the circle-jerkfest, gather information, analyze it and form your own thought. I know this. I try to challenge the status quo all the time. And yet, there are things so obviously true and self-evident that I don’t question them. What a mistake.

One such thing assumed to be true: that I’m not good at presenting. Why would I think such a thing? Because whenever I tried, I felt that utterly sucked. And when I asked others, they agreed. Sure, I was encouraged to “practice”, but the unspoken, implied vibe I always got? That I’ll always be mediocre at it. There is lots of common valid wisdom about how to improve your presentation skills. Avoid putting too much on your slides. Make eye contact with your audience. Always hold something in your hands. Never stare at the projection canvas. When making pauses, emphasize them to give everyone — not just yourself — a chance to think about what you’ve just said. All sound advice, and much of it is conveyed at school. But one thing isn’t: pick a subject you’re passionate about.

It doesn’t matter how much you royally suck at telling your classmates about how the assassination of Franz Fredinand of Austria ultimatley led to World War I, because even if you’re a history buff, chances are you don’t find that subject any more exciting than your audience does, and acting as if it is just isn’t gonna work well. Seriously, it won’t. Acting and speaking are two entirely different things.

As I said, I’d been suspecting this to be true for a while. But when I held a presentation on relational databases to a class on Wednesday, for 35 minutes, with most of the students intently listening, several telling me afterwards that it was fantastic, and one going so far as to say that he’s never had someone explain it so well, I finally knew.

You’ll still be nervous ahead of it. You’ll still want to avoid throwing up. You’ll still feel relieved afterwards. But believe you me, as long as you love what it is you’re talking about, you can blow everyone’s socks off. And you might even look forward to the next time.

We’ll start with the very end:

Daniel Eran Dilger is the author of “Snow Leopard Server (Developer Reference),” a new book from Wiley available now for pre-order at a special price from Amazon.

I don’t find it unreasonable to expect someone who writes such a book to strive for a certain level of accuracy. Having said that, let’s go:

Open source?

More importantly, Apple is providing its users with additional options that benefit both Mac users and the open source community.

What additional options for the open source community does Snow Leopard provide in the PIM area? A quote later on provides a clue what Dilger apparently thinks Apple has added:

Because Apple makes its money almost exclusively from selling hardware, it has opened up its own Snow Leopard Server applications, Address Book Server and iCal Server, as open source Darwin servers that can be compiled to run on Linux.

10.5 Leopard introduced the Apache-licensed Darwin Calendar Server, a subset of Leopard Server’s iCal Server, and this has been continuously updated (Snow Leopard Server ships with version 2). But while Snow Leopard Server ships with the new Address Book Server, there doesn’t appear to be any open source project for that. Marketing-wise, the iCal Server page mentions:

To further the widespread adoption and deployment of these standards, Apple has made the complete source code for iCal Server 2 available through the macosforge.org website.

No such thing for Address Book Server. Maybe they’re planning on it; maybe they’ve even said they are — but so far, this looks quite untrue. Dilger goes on:

That means Apple is essentially giving away both the client (to Mac users) and the servers (to the community) in order to encourage the use of open standards in messaging and collaboration.

No, the clients (Mail, Address Book and iCal) are most certainly commercial, closed-source software. Of the servers, all three are commercial and closed-source, although a subset of one is available in an open-source fashion. Which, by the way, is great on Apple’s part — but let’s not deny that a good configuration interface adds plenty of value, and Apple does not provide that for free (or otherwise openly).

Outlook not needed?

Next up, Dilger compares Apple’s trifecta of client apps to Outlook, with rather bold claims:

Integrated support for Exchange beginning with last year’s iPhone 2.0 means Apple’s mobile platform simply doesn’t need an Outlook client. Now Snow Leopard can also get by without Entourage/Outlook, thanks to new and improved baked-in support for Exchange in Mail, Address Book and iCal.

Microsoft has responded with the announcement that it will now be delivering a real (but still scaled back) version of Outlook for the Mac again

Now, unlike many, I’ve always been a fan of the separation into three apps. But even in 10.6, they are a far cry from Outlook being “simply not needed” or possibly to “get by without”. Public folders, anyone?

The Microsoft Bashing Tangent

With Snow Leopard and the iPhone each now providing their own client layer for accessing Exchange Server, Apple can now offer its users alternative access to other server products as well, from its own MobileMe and Snow Leopard Server offerings to web services from Google and Yahoo. This effectively turns Microsoft from a direct seller into a wholesaler that has to deal with Apple as a middleman retailer.

I’m sure this made some vague sense when it was written. It doesn’t when it’s read. The entire section goes on about Sears, CompUSA, Netscape, IE, IIS and off-shore wind energy. Actually, that last one was a lie. But a discussion of PIM client/server solutions this is not. He could have discussed Netscape’s brief ill-fated journey into the groupware market, but he didn’t. Instead, he’s talking about Microsoft’s evilness, implying a dominant position IIS has never had (”Microsoft first took control of the client with Internet Explorer and then began tying its IE client to its own IIS on the server side with features that gave companies reasons to buy all of their server software from Microsoft.”), and then switches over to everyone’s savior Apple with their open sourcing of Address Book Server, which hasn’t in fact happened. Finally, Snow Leopard Server apparently includes a “Push Notification Server”, which Apple knows so much about, nine out of the top ten results from Google are all articles of his, or links to them. So let’s skip this entire part.

Protocol confusion

Apple’s support for Exchange and its promotion of its own Exchange alternatives are two sides of the same coin, in the sense that they use the same technologies.

Well, this certainly is exciting news for Microsoft, who didn’t even know until this point that their very own Exchange Server has support for CalDAV and CardDAV built right in. (To be fair, it does for IMAP and LDAP, although it’s typically disabled.) Wouldn’t you love it if your developers don’t even have to build features, your marketing doesn’t even have to promote them, and yet you get to offer them?

Apple built its support for Exchange using WebDAV

No…

, the open specification that Microsoft supports on Exchange Server as a way to deliver messages to mobile clients.

…and no.

While Exchange Server has support for WebDAV, and WebDAV is very much an open specification, it’s such a broadly-specified protocol for file transfer and versioning over HTTP that it isn’t intended for mail, contacts, calendars, etc. in particular, so Microsoft has had to layer plenty of proprietary additions on top of it.¹ Yes, it uses WebDAV. No, that’s not all there is to it. It’s about as vague a claim as calling XML or CSV a format. For transferring files, WebDAV is a sufficient specification; for storing mails, contacts, calendar events, notes and more, including a ton of metadata, it’s incomplete — by design.

Apple did not license Microsoft’s Windows-only “Exchange Active Sync” software; it merely licensed the rights to implement a compatible EAS conduit with Exchange. Apple owns the Snow Leopard software that talks to Exchange.

This may be, but given that it’s in the same paragraph, I’m skeptical, and also question the relevance. It seems a poor and unnecessary attempt at making Apple look independent. Maybe they didn’t pay a licensing fee; instead, they had to pay their developers to develop client code of their own. So what?

The client applications Apple has upgraded in Snow Leopard to connect to Exchange, including Mail, Address Book, and iCal, also use WebDAV to talk to Apple’s own Snow Leopard Server applications.

The latter part is correct insofar as that CalDAV and CardDAV are extensions to WebDAV for calendars and contacts, respectively. They’re entirely incorrect for Mail (there is no WebDAV-based mail specification aside from Exchange Server’s proprietary method), as well as for Exchange.

This all leads to an entirely wrong conclusion:

This effort to support everything from integrated client software owned by Apple makes Snow Leopard’s support for Exchange of use to everyone, even if they don’t use Exchange. The client work Apple has invested in making Macs Exchange-friendly also improves the features available via MobileMe, Snow Leopard Server, and even some other third party services such as those from Google and Yahoo.

On top of incorrectly believing that Snow Leopard interfaces with Exchange Server through WebDAV, Dilger apparently goes even further that, since CalDAV, CardDAV and his imaginary MailDAV² are built on top of WebDAV and Exchange uses WebDAV as well, Apple is saving duplicate effort. That would be great. It’s also entirely off. First, Snow Leopard communicates with Exchange Server through the much newer, SOAP-based Exchange Web Services protocol. That’s why it requires 2007 Service Pack 1 Update Rollup 4; this entire interface is lacking in 2003 (and in the original 2007 release). Second, even if they were to use WebDAV, this wouldn’t help them much at all.

Imagine two CSV files, one with the columns Surname, Name and Birthday, and another with the columns Last name, First name and Phone number. Superficially to the human eye, they both clearly contain contacts. To the computer, they’re entirely different formats. One column is missing from each other’s format, and while two out of three columns have the same contents, they’re differently named. You’d have to write a converter to make them match. You have the same situation with different XML formats³, and with two different takes at implementing, say, calendars on top of WebDAV. And given that Microsoft is moving away from WebDAV, citing lack of efficiency, they probably won’t implement CalDAV any day now.

The App Store Tangent

App Store? Really? What does that have to do with anything?

The success of the iPhone App Store has benefited both developers and users by establishing a competitive market based on meritocracy. Snow Leopard’s support for Exchange, because it opens up equal access to alternative competition, similarly creates an iPhone-like market for desktop messaging services ranked by merit, not the vendor’s current market position.

Yes, vendors like, say, Microsoft. Also, software companies located in Redmond, Washington state. Can someone explain to me how an interface to a proprietary PIM protocol “creates a market ranked by merit”?

This will provide Snow Leopard users with not just the ability to talk to corporate Exchange Servers, but also the ability to access Apple’s own offerings and other third party services.

I’ll get right around to implementing Exchange Web Services in my own groupware. Surely the specification is somewhere on ietf.org. Oh, wait.

1. That’s not a criticism; it’s just a fact of life. ↩
2. MessageDAV? LetterDAV? Running out of corny specification names quickly. ↩
3. Consider Atom vs. RSS. ↩